SSL uses asynchronous encryption, which means that one key (the private key) is given to the server that "owns" the key pair, while the other key (the public key) is distributed freely.
It is called asynchronous because data encrypted with the private key can only be decrypted with the public key, while data encrypted with the public key can only be decrypted with the private key. So if you want to send something securely to the owner, you encrypt it with his private key and he will be the only one who can decrypt it. If the owner wants to prove that he sent something, he encrypts it with the private key and anyone who has the public key can decrypt it. (Once the certificates are installed, this is usually done behind the scenes by the browser or email tool.)
Since the owner wants to keep that private key private, it will be password protected and given ONLY to the owning server (often in a PFX or P12 file). But the public key will be distributed freely (often in a CER file).
